JP7028543B2 - Communications system - Google Patents

Description

The present invention relates to a monitoring device, a switch, a communication device, a communication system, a monitoring method, and a monitoring program for monitoring communication.

In recent years, as collectively referred to as the IoT (Internet of Things), everything has come to be connected to the Internet. For example, a unique protocol is used to newly connect the control network of a factory or plant that was communicating to the Internet. Therefore, endpoint terminals such as machine tools, sensors and cameras in factories (hereinafter referred to as "end terminals") will also be connected to the Internet.

By connecting to the Internet in this way, various benefits such as new added value and device management can be obtained, while malicious persons using means such as unauthorized access, DoS attack (Denial of Service attack), and virus. You will also be exposed to threats from.

Therefore, as a means of protecting the end terminal from such threats, it is first conceivable to install antivirus software on the end terminal.

For example, in the specification paragraph numbers [0007] and [0008] of Patent Document 1, antivirus software should be installed in each of the end terminals included in the system in order to prevent data destruction by a virus, a hacker, or the like. Describes that it protects the end terminal from threats from malicious persons.

In addition, as another means for protecting end terminals from threats from malicious persons, for example, a firewall may be provided at the connection portion between the LAN (Local Area Network) that controls these end terminals and the Internet. Conceivable. By providing a firewall in this way, it is possible to protect the end terminal from threats from malicious persons via the Internet.

Japanese Patent Application Laid-Open No. 2015-72704

As described above, the end terminals can be protected by installing antivirus software or providing a firewall on each end terminal.

However, in many cases, a general-purpose OS (Operating System) is not implemented in end terminals such as work terminals, sensors, and cameras installed in factories and plants, which are mentioned as an example in the above explanation, and in this case, a virus. I can't install the countermeasure software.

Therefore, antivirus software cannot protect the end terminal from threats, and the end terminal is infected with a virus, etc., sending frames to unexpected destinations or sending an unexpected amount of frames, which puts pressure on the line. Or. In addition, since dedicated appliances such as firewalls are located at the entrances and exits of the Internet and the internal LAN, unexpected communication between end terminals connected to the internal LAN (for example, abnormal communication caused by virus infection) and the end Abnormal communication peculiar to the end terminal caused by a terminal failure cannot be detected.

That is, it is difficult to prevent inappropriate communication with the existing technology described in Patent Document 1 and the like.

Therefore, an object of the present invention is to provide a monitoring device, a switch, a communication device, a communication system, a monitoring method, and a monitoring program capable of preventing inappropriate communication.

According to the first aspect of the present invention, the monitoring device includes a storage means for storing a list of conditions of data to be processed by a predetermined process and an analysis means for analyzing the data, wherein the analysis is performed. The means analyzes the data transmitted and received by the terminal connected to the self-monitoring device without going through the relay device for route selection, and if the analysis result matches any of the conditions included in the list, the analysis result. If the received data corresponding to the above is subjected to the predetermined processing and the comparison analysis result does not match any of the conditions included in the list, the received data corresponding to the data is subjected to other than the predetermined processing. A monitoring device characterized by performing the processing of the above is provided.

According to the second aspect of the present invention, the communication system includes a plurality of monitoring devices provided by the first aspect of the present invention and also includes the plurality of terminals, and each of the plurality of terminals is described above. A communication system is provided characterized in that it is connected to at least one of a plurality of monitoring devices.

According to the third aspect of the present invention, the switch includes a plurality of monitoring devices provided by the first aspect of the present invention, and also includes a plurality of ports for connecting the terminals. Each of the switches corresponds to at least one of the plurality of monitoring devices, and each of the terminals is also connected to a monitoring device corresponding to a port to which the own terminal is connected. Will be done.

According to the fourth aspect of the present invention, the communication device includes the monitoring device provided by the first aspect of the present invention and the terminal connected to the monitoring device, and the terminal is the monitoring. A communication device characterized in that communication is performed via the device is provided.

According to the fifth aspect of the present invention, it is a monitoring method performed by a monitoring device provided with a storage means for storing a list of data conditions to be processed by a predetermined process, via a relay device for route selection. The data sent and received by the terminal connected to the self-monitoring device is analyzed, and if the analysis result matches any of the conditions included in the list, the predetermined processing is performed on the received data corresponding to the analysis result. If the comparison analysis result does not match any of the conditions included in the list, the monitoring method is characterized in that processing other than the predetermined processing is performed on the received data corresponding to the data. Provided.

According to the sixth aspect of the present invention, it is a monitoring program that functions as a monitoring device with a computer provided with a storage means for storing a list of data conditions to be processed, and the computer is route-selected. The data sent and received by the terminal connected to the self-monitoring device is analyzed without going through the relay device, and if the analysis result matches any of the conditions included in the list, the received data corresponding to the analysis result is obtained. If the comparison analysis result does not match any of the conditions included in the list, the received data corresponding to the data is subjected to processing other than the predetermined processing. A monitoring program is provided that is characterized by functioning as a device.

According to the present invention, it is possible to prevent inappropriate communication.

It is a figure which shows the basic structure of each embodiment of this invention. It is a functional block diagram included in the monitoring apparatus in 1st Embodiment of this invention. It is a figure which shows an example of the flow list in the 1st monitoring apparatus in each embodiment of this invention. It is a figure which shows an example of the flow list in the 2nd monitoring apparatus in each embodiment of this invention. It is a figure which shows an example of the flow list in the Nth monitoring apparatus in each embodiment of this invention. It is a figure which shows an example of the flow list in the Mth monitoring apparatus in each embodiment of this invention. It is a flowchart which shows the basic operation in 1st Embodiment of this invention. It is a figure which shows the example of the frame received by the Mth monitoring apparatus in each embodiment of this invention, and the setting example about the flow list set in the analysis part. It is a functional block diagram included in the monitoring apparatus in the 2nd Embodiment of this invention. It is a flowchart which shows the basic operation in the registration period in the 2nd Embodiment of this invention. It is a figure which shows the example of the frame received by the M monitoring apparatus in the registration period in the 2nd Embodiment of this invention, and the setting example about the registration period set in the analysis part. It is a figure which shows one of the modification of the basic structure of each embodiment of this invention. It is a figure which shows one of the modification of the basic structure of each embodiment of this invention.

Next, the outline of each of the first embodiment and the second embodiment of the present invention will be described.

First, in the first embodiment of the present invention, a monitoring device is connected to each end terminal, and each end terminal transmits and receives frames to and from other end terminals via this monitoring device. Then, the monitoring device monitors the frames transmitted or received by each end terminal. Then, depending on the monitoring result, processing such as passing the frame or discarding without passing the frame is performed.

As a result, it is possible to pass a frame that should be passed and not to pass an unexpected inappropriate frame that should not be passed, and it is possible to prevent inappropriate communication.

Here, as a method of determining whether or not the frame should be passed, for example, a source or destination address, etc., which are considered to be related to malware infection or Dos attack, a protocol type, etc. are prepared as a list. A method of making a judgment by comparing this list with a frame can be considered.

However, since it is possible to receive a new unknown attack from an unknown communication destination, list all the addresses, protocol types, etc. of all communication destinations that are considered to have problems. Is very difficult.

Therefore, in the first embodiment of the present invention, an address or the like that specifies a communication destination that is considered to have no problem is not listed, but an address or the like that specifies a communication destination that is considered to have a problem or a protocol type or the like. , Protocol type, etc. are listed, and for example, forwarding is permitted for frames that match this list, and for example, frames that do not match this list are discarded.

Further, a second embodiment of the present invention further adds the ability to automatically generate at least a portion of such a list.

Specifically, the monitoring device is provided with a registration period and an operation period. Then, the list is automatically generated by adding the information extracted from the frame input to the monitoring device to the list during the registration period. However, at this time, it may be possible to manually add or delete the automatically generated list by the user's operation.

After that, the registration period is switched to the operation period, the frame information input to the monitoring device is compared with the list automatically generated during the registration period, and if they match, the frame is passed, and if they do not match, the frame is discarded. Continue to do that.

This makes it possible to automatically generate a list and manage security using the list.

Next, each embodiment will be described in detail with reference to the drawings.

<First Embodiment>
Referring to FIG. 1, the present embodiment includes a plurality of monitoring devices 100, a plurality of end terminals 200, a switch 300, a PLC400, a PC500, a firewall device 600, an Internet 700, a first network 800, a second network 900, and a setting. Includes terminal 1000.

In the following description, when any one of the first monitoring device 100-1, the second monitoring device 100-2, the Nth monitoring device 100-N and 100-M is specified, the first monitoring device 100-1 is specified. Like the monitoring device 100-1 and the Nth monitoring device 100-N, the numbers and alphabets at the end are described, but when any of them is not specified, it is simply described as the monitoring device 100. For example, when explaining a configuration or the like common to each monitoring device 100, it is simply referred to as the monitoring device 100. Similarly, when any one is not specified, it is simply referred to as an end terminal 200. Further, in this example, N is a "natural number of 3 or more" and M is a "natural number obtained by adding 1 to N".

Next, the connection of each of these devices will be described. In this embodiment, the PLC 400 and the PC 500 communicate with each other in the first network 800. Here, the first network 800 is, for example, a LAN (Local Area Network) constructed in an office attached to a factory or a plant. Further, the first network 800 can be connected to any device, and may include, for example, other devices (not shown) such as a printer. The first network 800 is connected to the Internet 700, and a firewall device 600 is provided at the boundary between the first network 800 and the Internet 700. The firewall device 600 prevents the intrusion of inappropriate data such as a virus.

On the other hand, the PLC 400 and each end terminal 200 communicate with each other in the second network 900. Here, the second network 900 is, for example, a control network for controlling equipment constructed in a factory or a plant.

Here, the above-mentioned firewall device 600 functions in communication with a device existing in the Internet 700, but does not function in communication between each end terminal 200. Therefore, in the present embodiment, in order to prevent inappropriate communication between the end terminals 200, the monitoring device 100 is connected to each end terminal 200 in a one-to-one relationship.

The end terminal 200 may be connected to the Nth monitoring device 100-N in the future, but it is assumed that the end terminal 200 is not connected at this time. In order to represent this point, it is represented as "(unarranged)" in FIG.

Here, the monitoring device 100 is a monitoring device for monitoring communication between the end terminals 200 and communication between the end terminals 200 and the PLC 400, which is performed via the switch 300.

The monitoring device 100 discards an inappropriate frame transmitted by an act of a malicious person or the like by performing a process using the florist as described above.

Here, the monitoring device 100 is provided with two connection ports as described as "P0" and "P1" in the figure. Then, the end terminal 200 or the PLC 400 is connected to the port "P0". On the other hand, the switch 300 is connected to the port "P1".

A relay device or the like (not shown) may further exist between the port “P1” and the switch 300. This is because the frame transmitted / received by P1 is a frame that has already been monitored by any of the monitoring devices 100, and such a frame is an appropriate frame that is not related to a virus or the like, and is a route by the relay device. This is because it should be forwarded to the original destination by selection.

On the other hand, there is no relay device for route selection between the port "P0" and the end terminal switch 300, or between the port "P0" and the end terminal 100, and it is preferable to have a configuration in which they are directly connected. ..

The reason will be explained. For example, when the first end terminal 200-1 is infected with a virus and the destination transmits a large amount of inappropriate unnecessary frames, the first monitoring device 100-1 and the first end terminal 200- This is because if a relay device exists between 1s, the relay device may transfer unnecessary frames to another end terminal or the like. In order to prevent this, "P0" and the end terminal switch 300 and "P0" and the PLC400 are directly connected to each other, and for example, the frame transmitted by the first end terminal 200-1 is first set. This is because it is necessary to monitor everything with the monitoring device 100-1.

The plurality of end terminals 200 are terminals each having a communication function. The end terminal 200 communicates with another end terminal 200 or the PLC 400 via the switch 300. Such communication is executed in accordance with general protocols such as IP (Internet Protocol), TCP (Transmission Control Protocol), and UDP (User Datagram Protocol). It should be noted that there is no particular limitation on the content of the data actually exchanged, that is, what kind of content is included in the payload portion.

Further, the end terminal 200 may be realized by a terminal that is directly operated by the user, but may be realized by equipment such as a machine tool, a sensor, and a camera installed in a factory or a plant. In the following description, it is assumed that the first end terminal 200-1 is a machine tool installed in a factory and the second end terminal 200-2 is a sensor.

The switch 300 is a relay device that transfers a frame performed between each end terminal switch 300 or between each end terminal switch 300 and the PLC 400 according to a destination address in the frame. The switch 300 is realized by, for example, an L2 switch.

The PLC 400 is a PLC (Programmable Logic Controller) that controls a machine tool. The PLC 400 sends and receives frames to and from each end terminal 200 in order to give a predetermined operation instruction to each end terminal 200 and to monitor the failure of each end terminal 200.

The PC 500 is a personal computer used in the first network 800, and communicates with other devices existing in the Internet 700 or communicates with the PLC 400 via the firewall device 600.

The firewall device 600 is a device for realizing a firewall as described above. By controlling the data transmitted / received between the first network 800 and the Internet 700, the firewall device 600 can prevent, for example, communication by unintended software.

The connection by the Internet 700, the first network 800 and the second network 900 is as described above.

The setting terminal 1000 is a terminal for making settings for each monitoring device 100 and receiving notifications from each monitoring device 100. In the figure, the setting terminal 1000 is connected to each monitoring device 100 via the switch 300, but it is not always necessary to go through the switch 300 in this way. That is, the setting terminal 1000 and each monitoring device 100 may be directly connected without going through the switch 300. Even when the setting terminal 1000 is directly connected without going through the switch 300 in this way, the setting terminal 1000 can make settings for each monitoring device 100 and receive a notification from each monitoring device 100. Can be done.

Here, the setting terminal 1000 is used by an administrator or the like who manages the present embodiment. The setting terminal 1000 may be realized by a dedicated terminal for setting the monitoring device 100, but may be realized by a general-purpose terminal such as a personal computer to which software or the like for setting the monitoring device 100 is added. Is also good. The specific contents of the setting by the setting terminal 1000 and the notification from the monitoring device 100 will be described later.

Next, the functional blocks included in the monitoring device 100 will be described with reference to FIG. Referring to FIG. 2, the monitoring device 100 includes a frame analysis unit 110, a florist generation unit 120, and a florist storage unit 130.

The frame analysis unit 110 analyzes the received input frame each time the monitoring device 100 receives an input frame from the outside on the port “P0” or the port “P1”. Here, the analysis is to extract predetermined information (hereinafter referred to as "frame information") from the received input frame.

The frame information is, for example, predetermined information specified to be described by each protocol used for communication. As a specific example, it is necessary information of a higher layer than the layer 3 (IP header) information depending on the receiving port number, the layer 2 (MAC header) information, and the frame type. In the present embodiment, by using the frame information conforming to such a general-purpose protocol, it is possible to eliminate the need for processing such as embedding special information or the like in the payload portion.

Further, in the present embodiment, all of these information may be used in the frame information and each list, but some combinations of information may be used. For example, only layer 2 (MAC header) information may be used, or a combination of layer 2 (MAC header) information and layer 3 (IP header) information may be used.

Further, for example, if layer 2 (MAC header) information is to be used, all layer 2 (MAC header) information may be used, but the destination address (MAC-DA (Destination address)), which is a part of the layer 2 (MAC header) information, may be used. )), The destination address (MAC-SA (Source address)) may be used, or a combination thereof may be used.

Further, the frame analysis unit 110 extracts frame information from the received input frame when the input frame is received. Then, the extracted frame information is compared with the frame information registered in the flow list stored in the flow list storage unit 130. Then, as a result of comparison, the monitoring device 100 performs a predetermined operation depending on whether it matches or does not match.

What kind of operation the predetermined operation is specifically is set as "operation setting". The operation setting is performed by, for example, an instruction from the setting terminal 1000, a DIP switch provided in the monitoring device 100, or the like.

For example, if it matches the florist, it can be set to pass the corresponding frame. Here, “passing” means that the received input frame is passed through the monitoring device 100 including the frame analysis unit 110 and output as an output frame. Here, the input frame received at the port “P0” is taken as an output frame from the port “P1”. On the other hand, the input frame received at the port “P1” is taken as an output frame from the port “P0”.

That is, since the monitoring device 100 of the present embodiment does not perform routing like a switch, the frame passes through the monitoring device 100 in the case of passing.

On the other hand, if the flow list does not match, the corresponding frame, which is the frame from which the compared frame information is extracted, can be set to be discarded.

In addition to this, it is also possible to set whether or not to notify the flow list when it matches or does not match. The content of the notification may be only that it matches the florist or that it does not match, but the frame corresponding to the frame information may be duplicated and the duplicated frame may be included in the notification. Then, for example, a virtual communication system may be created by the setting terminal 1000, and the duplication of the frame may be communicated in the virtual communication system so that the influence of the malicious frame can be known.

The notification destination may be, for example, the setting terminal 1000, or may be another server device or the like. Further, instead of or together with the notification, the frame corresponding to the frame information may be recorded inside the monitoring device 100. The administrator or the like who manages the present embodiment can grasp the communication status in the present embodiment by referring to the content of the notification and the content recorded in the monitoring device 100 as a log. In the following, performing such recording is referred to as "taking a log", and not performing such recording is referred to as "not taking a log" below.

The output for taking notifications and logs performed by the frame analysis unit 110 is referred to as "notification output (recording)" in FIG.

The flow list generation unit 120 generates a flow list stored in the flow list storage unit 130, and the flow list generation unit 120, which is a part in which the generated flow list is stored in the flow list storage unit 130, describes the generation of the flow list. do.

First, a user such as an administrator who uses the present embodiment uses the setting terminal 1000 to input frame information of a regular frame transmitted and received by each end terminal 200 or PLC 400 in a normal time when the terminal terminal 200 or PLC 400 is not infected with a virus or the like. It is set in the flow list generation unit 120. Such a setting is referred to as "flow setting" in FIG.

In this respect, as a premise, each end terminal 200 or PLC400 is a device that transmits / receives a predetermined frame assumed in advance to / from a predetermined communication destination, and does not transmit / receive an unexpected communication destination and an unexpected frame. Assuming that. For example, it is possible to specify what kind of predetermined frame is transmitted / received to which communication destination based on the device specifications of each end terminal 200 or PLC400.

Therefore, a user such as an administrator can know the frame information of the frame assumed in advance, and can set this in the florist generation unit 120.

The flow list generation unit 120 converts the frame information set from the setting terminal 1000 into a data structure that can be referred to by the frame analysis unit 110 to obtain a flow list. Then, the created florist is registered in the florist storage unit 130.

At the beginning of using this embodiment, the flow list is created by the flow list generation unit 120, but after that, the flow list may be modified by the setting from the setting terminal 1000.

For example, the administrator who uses the setting terminal 1000 may be able to delete a part of the frame information of the florist or add new frame information to the florist. By doing so, for example, when a new end terminal 200 is added, it is possible to pass a frame related to the newly added end terminal 200 without resetting the entire flow list.

In addition, for example, when a part of the existing end terminal 200 is removed, the frame information related to the removed end terminal 200 can be deleted from the florist.

The florist storage unit 130 is a storage unit that stores the florist. The florist stored in the florist storage unit 130 is generated by the florist generation unit 120 as described above. The flow list stored in the flow list storage unit 130 is referred to and used by the frame analysis unit 110.

In the florist, for example, frame information of a frame to be passed through the frame analysis unit 110 is set. Specifically, the frame information for specifying the frame of the protocol used in each end terminal 200, and the frame for specifying the frame including the address representing the destination or the source used in each end terminal 200. The information is included in the flow list.

This time, the elements constituting the florist are the device, layer 2, layer 3, and layer 4, but as described above, it is not always necessary to include all of them as elements, and some of them may be combined or others. You may add the element of.

Next, in the present embodiment, a specific example of the flow list created in the flow list generation unit 120 and stored in the flow list storage unit 130 in each monitoring device 100 will be described.

Based on the device specifications of each end terminal 200 and PLC400, it is assumed that the regular frames assumed in advance are as follows. Then, it is assumed that the frames other than the following frames are unexpectedly unsuitable frames.

<Assumed regular frame>
(1) Each end terminal 200 shall transmit a frame to the PLC 400. Therefore, a frame from the first end terminal 200-1 to the PLC 400 and a frame from the second end terminal 200-2 to the PLC 400 are assumed.
(2) Since the PLC 400 transmits a frame only to the second end terminal 200-2, a frame from the PLC 400 to the second end terminal 200-2 is assumed.
Frames other than the above source and destination are not assumed.
(3) It is assumed that the type used for communication in layer 2 is "IPv4". Further, it is assumed that the protocol used in layer 3 is "6 (TCP)".

Frame information corresponding to such an assumed regular frame is set by the setting terminal 1000, and a florist is created in the florist generation unit 120 and stored in the florist storage unit 130 accordingly. ..

In this case, the flow list stored in the flow list storage unit 130 of each monitoring device 100 will be described with reference to FIGS. 3-1 to 3-4.

First, FIG. 3-1 shows a flow list stored in the flow list storage unit 130 of the first monitoring device 100-1. In this regard, from the above (1), the frame information (corresponding to the florist item No. 1 in the figure) of the frame transmitted from the first end terminal 200-1 to the PLC 400 is included in the flow list. Such frame information also satisfies the above (3).

Next, FIG. 3-2 shows a flow list stored in the flow list storage unit 130 of the second monitoring device 100-2. In this regard, from the above (1), the frame information (corresponding to the florist item No. 1 in the figure) of the frame transmitted from the first end terminal 200-1 to the PLC 400 is included in the flow list. Such frame information also satisfies the above (3).

Next, FIG. 3-3 shows a flow list stored in the flow list storage unit 130 of the Nth monitoring device 100-N. In this respect, since the end terminal 200 is not connected to the Nth monitoring device 100-N, a frame passing through the Nth monitoring device 100-N is not assumed. Therefore, no frame information is included in the flow list.

Next, FIG. 3-4 shows a flow list stored in the flow list storage unit 130 of 100-M. In this regard, from the above (1), the frame information of the frame transmitted from the first end terminal 200-1 to the PLC 400 (corresponding to the florist item No. 1 in the figure) and the second end terminal 200-2. The frame information (corresponding to the florist item No. 2 in the figure) of the frame transmitted from the to the PLC 400 is included in the florist. In addition, from the above (2), the frame information (corresponding to the florist item No. 3 in the figure) of the frame transmitted from the PLC 400 to the second end terminal 200-2 is included in the flow list. These frame information also satisfy the above (3).

Next, the operation when the monitoring is executed by using the flow list stored in this way will be described with reference to the flowchart of FIG. This time, the monitoring by 100-M will be described as an example, but it is assumed that the other monitoring devices 100 also operate in the same manner.

First, when the monitoring device 100 receives an input frame, the frame analysis unit 110 analyzes the received input frame to extract frame information (step S11). Here, an example of frame information extracted from the received frame is shown as Table 2 in the upper part of FIG.

It is assumed that the frame information of the received input frames is extracted for 6 frames in the order of Table 2. This time, the legitimate frames assumed by the above (1) to (3) are received, but after a while, the PLC400 is infected with a virus, and the unexpectedly inappropriate frames other than the above legitimate frames are received. Assume that the frame is being received. Details will be described later.

Further, the "operation settings" set in the frame analysis unit 110 are shown in Table 3 at the bottom of FIG.

As shown in Table 3, in this example, when the frame information extracted from the received frame matches the frame information registered in the florist, the frame from which the frame information is extracted is passed. Also, in this case, no notification is given and no log is taken.

On the other hand, as shown in Table 3, in this example, if the frame information extracted from the received frame does not match the frame information registered in the florist, the frame from which this frame information is extracted is the frame. Discard. In this case, a notification to that effect is given and a log is also taken.

Next, the frame analysis unit 110 compares the extracted frame information with the flow list stored in the flow list storage unit 130, and determines whether or not they match (step S12).

Here, for example, it is assumed that the frame information of the frame of the input sequence number 1 in Table 3 is the target of the determination. In this case, it matches the item number 1 of the flow list stored in the prohibited list storage unit 130 in Table 1-M (Yes in step S12). Further, for example, it is assumed that the frame information of the frame of the input sequence number 2 in Table 3 is the target of the determination. In this case, it matches the item number 2 of the flow list stored in the prohibited list storage unit 130 in Table 1-M (Yes in step S12). Further, for example, it is assumed that the frame information of the frame of the input sequence number 3 in Table 3 is the target of the determination. In this case, it matches the item number 3 of the flow list stored in the prohibited list storage unit 130 in Table 1-M (Yes in step S12).

Therefore, in these cases, the process proceeds to step S13.

In step S13, the frame analysis unit 110 matches the flow list with respect to the frame of the input sequence number 1, the frame of the input sequence number 2, and the frame of the input sequence number 3 corresponding to the frame information matching the flow list. In this case, the process is performed according to the instruction of the operation setting (step S13).

If they match, as described above, in Table 3, it is "passing the corresponding frame, not notifying, not taking the log", so that the frame analysis unit 110 passes through the monitoring device 100 including the frame analysis unit 110 in the frame. Output the frame by making it. However, it does not notify and does not log.

When the process of step S13 is completed, the process returns to step S11, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information does not match the florist in step S12 (No in step S12), the process proceeds to step S14.

For example, it is assumed that the frame information of the frame of the input sequence number 4 and the frame information of the frame of the input sequence number 5 in Table 2 are the targets of the determination. These frames are frames transmitted from the PLC400 due to the infection of the PLC400 with a virus, and are not the first end terminal 200-1 which is the expected destination of the legitimate frame, but the second end terminal. This is the frame transmitted for 200-2. In this case, such a frame is not assumed, and the florist does not include the frame information corresponding to such a frame. Therefore, it does not match any of the item No. 1, item No. 2 and item No. 3 of the flow list stored in the prohibited list storage unit 130 in Table 1-M (No in step S12). Therefore, the process proceeds to step S14. Further, for example, it is assumed that the frame information of the frame of the input sequence number 6 in Table 2 is the target of the determination. This frame is a frame transmitted from the PLC400 due to the infection of the PLC400 with a virus, and is addressed to the second end terminal 200-2, which is assumed to be a legitimate frame, but is a legitimate frame. It is a frame compliant with IPv6, not IPv4 assumed in. In this case, such a frame is not assumed, and the florist does not include the frame information corresponding to such a frame. Therefore, it does not match any of the item No. 1, item No. 2 and item No. 3 of the flow list stored in the prohibited list storage unit 130 in Table 1-M (No in step S12). Therefore, the process proceeds to step S14.

In step S14, the frame analysis unit 110 makes a flow list for the frame of the input sequence number 4, the frame of the input sequence number 5, and the frame of the input sequence number 6 corresponding to the frame information that does not match the flow list. If it does not match with, the process is performed according to the instruction of the operation setting (step S14).

If they do not match, as described above, the table 3 shows "discard the corresponding frame, notify, and log", so the frame analysis unit 110 discards the frame. In addition, the frame analysis unit 110 notifies the setting terminal 1000 of the fact that it has been discarded, and also records the fact that it has been discarded. At this time, it is advisable to include a copy of the discarded frame in the notification or log.

When the process of step S13 is completed, the process returns to step S11, and each of the above operations is repeated for the newly received frame.

By the above-mentioned operation, in the present embodiment, the frame having the frame information matching the flow list is passed through the monitoring device 100 including the frame analysis unit 110, and the frame having the frame information not matching the flow list is passed to the frame analysis unit 110. Can be disposed of.

As a result, it is possible to discard frames that are considered to be unexpectedly inappropriate and whose frame information does not match the flow list, so that malicious frames caused by a virus or the like can be prevented from spreading on the second network 900. be able to.

On the other hand, since it is possible to pass a frame that is considered appropriate within the assumption that the florist and the frame information match, it is assumed that a malicious frame caused by a virus or the like is being transmitted. However, communication with an appropriate frame can be continued. That is, when a part of the end terminals 200 is infected with a virus, the availability can be maintained even if the end terminals 200 cannot be quickly isolated.

<Second embodiment>
Next, the second embodiment will be described. In the first embodiment described above, the frame information corresponding to the regular frame assumed to be transmitted and received between the end terminals 200 as exemplified in (1), (2) and (3) is the setting terminal. The flow list was set by 1000, and the flow list was created in the flow list generation unit 120 and stored in the flow list storage unit 130 accordingly.

On the other hand, in the present embodiment, the flow list generation unit 120 has a function of automatically generating at least a part of the flow list without requiring the setting by the setting terminal 1000.

This point will be described with reference to FIGS. 6 and 7. The parts common to the present embodiment and the first embodiment will not be described again.

As shown in FIG. 6, in the present embodiment, the setting terminal 1000 performs not only the above-mentioned "flow setting" and "operation setting" but also "registration period setting".

Specifically, the frame analysis unit 110 is set with two settings, "registration period setting" and "operation setting", by the setting terminal 1000.

Here, in the present embodiment, as described above, there are two periods, a registration period and an operation period, and the registration period and the operation period are switched by the registration period setting. In addition, when a predetermined time elapses after being set to the registration period once, the operation period is automatically changed. The length of the predetermined time can be arbitrarily set according to the environment. For example, in an environment where the contents of frames transmitted / received between the end terminals 200 are limited, if one hour is required and all the limited frames are transmitted / received, the above-mentioned predetermined time Should be 1 hour. If it takes one week for all the limited frames to be transmitted and received, the above predetermined time may be set to one week.

Then, the frame analysis unit 110 extracts the frame information from the received input frame when the input frame is received and the registration period is reached, and passes the frame information to the flow list generation unit 120 described later.

Then, the florist generation unit 120 adds the passed frame information to the florist stored in the florist storage unit 130 as the frame information of the assumed normal frame. By doing so, the florist can be automatically generated during the registration period. During the registration period, the received frames are processed according to the operation setting instructions.

For example, if "passes corresponding frame, does not notify, does not take log", the frame analysis unit 110 outputs a frame by passing the monitoring device 100 including the frame analysis unit 110 through the frame. However, it does not notify and does not log.

After that, when the predetermined time has elapsed or the operation period has been entered by the operation from the setting terminal 1000, the flow list generation unit 120 ends the process of automatically generating the flow list. After that, the operation of the present embodiment during the operation period is the same as the operation of the first embodiment. Also in this embodiment, it is possible to partially delete the flow information from the flow list or add the flow information to the flow list by operating the flow setting from the setting terminal 1000.

Next, the operation of the present embodiment during the registration period will be described with reference to the flowchart of FIG. 7. In the following, the operation of 100-M will be described as an example, but it is assumed that the other monitoring device 100 also performs the same operation.

The monitoring device 100 first determines whether or not the frame analysis unit 110 is set in the registration period (step S21). Here, if the registration period is set (Yes in step S21), the process proceeds to step S22. On the other hand, if it is not set in the registration period (No in step S21), that is, if it is set in the operation period, the processes of steps S11 to S14 described with reference to FIG. 4 are performed. .. The contents of the processing of steps S11 to S14 are the same as those of the first embodiment.

In step S22, the frame analysis unit 110 analyzes the received frame and extracts the frame information. Then, the extracted frame information is passed to the florist generation unit 120 (step S22).

An example of frame information extracted from the frames received during the registration period is shown as Table 4-M in the upper part of FIG. It is assumed that the frame information of the received input frame is passed to the flow list generation unit 120 for 3 frames in the order of Table 4-M. Specifically, from the above (1), the frame information of the frame transmitted from the first end terminal 200-1 to the PLC 400 (corresponding to the flow list item No. 1 in the figure) and the second The flow list includes frame information (corresponding to flow list item No. 2 in the figure) of a frame transmitted from the end terminal 200-2 to the PLC 400. In addition, from the above (2), the frame information of the frame transmitted from the PLC 400 to the second end terminal 200-2 (corresponding to the florist item No. 3 in the figure) is included in the florist. These frame information also satisfy the above (3).

Next, the flow list generation unit 120 converts the passed frame information into a data structure that can be referred to by the frame analysis unit 110 to obtain a flow list. Then, the created flow list is stored in the flow list storage unit 130 (step S23).

By the above processing, the same flow list as in Table 1-M of FIG. 3-4 is stored in the flow list storage unit 130. That is, it is possible to realize the automatic generation of the florist in the present embodiment.

On the other hand, after extracting the frame information, the frame analysis unit 110 follows the instruction of the operation setting in the registration period for the received frame of the input sequence number 1, the frame of the input sequence number 2, and the frame of the input sequence number 3. Processing is performed (step S24). Here, as shown in Table 5 at the bottom of FIG. 8, it is assumed that the operation setting during the registration period is "passing corresponding frame, do not notify, do not log". Then, the frame analysis unit 110 passes the monitoring device 100 including the frame analysis unit 110 to each of the frame of the input sequence number 1, the frame of the input sequence number 2, and the frame of the input sequence number 3 according to the operation setting. Outputs a frame by. However, it does not notify and does not log.

Next, in step S25, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S25), the processes of steps S11 to S14 described with reference to FIG. 4 are performed as step S26. The contents of the processing of steps S11 to S14 are the same as those of the first embodiment.

On the other hand, if it has not elapsed (No in step S25), the process returns to step S22, and each of the above operations is repeated for the newly received frame.

According to the above-mentioned operation, in the present embodiment, the flow list can be automatically generated from the start of the registration period to the elapse of a predetermined time, and the received frame can be passed through the frame analysis unit 110. Therefore, the flow list can be automatically generated while transmitting and receiving frames as usual, and it is possible to save a user such as an administrator from having to set the flow using the setting terminal 1000.

Each of the above-mentioned monitoring device, end terminal and setting terminal can be realized by hardware, software or a combination thereof. Further, the relay method performed by the above-mentioned monitoring device, end terminal and setting terminal can also be realized by hardware, software or a combination thereof. Here, what is realized by software means that it is realized by a computer reading and executing a program.

Programs can be stored and supplied to a computer using various types of non-transitory computer readable medium. Non-temporary computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), optomagnetic recording media (eg, optomagnetic disks), CD-ROMs (Read Only Memory), CD-. Includes R, CD-R / W, semiconductor memory (eg, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory)).

Further, although the above-described embodiment is a preferred embodiment of the present invention, the scope of the present invention is not limited to the above-mentioned embodiment, and various modifications have been made without departing from the gist of the present invention. It can be implemented in the form.

For example, each embodiment can be modified as follows.

In each of the above embodiments, the monitoring device 100 is connected between the switch 300 and the PLC 400, or between the switch 300 and the end terminal 200. That is, the switch 300 for route selection and the monitoring device 100 for monitoring have been realized as separate devices.

However, instead of doing so, as in the security switch 2000 shown in FIG. 9, one device has a route selection function as a switch 300, and each port of the switch 300 has a monitoring function as a monitoring device 100. You may let it. By doing so, it is sufficient that the route selection and monitoring can be executed by a single device called the security switch 2000. Both the single monitoring device 100 and the security switch 2000 may be mixed in one network.

In addition, as shown in FIG. 10, a monitoring device 100 is mounted as a NIC (Network Interface Card) for the end terminal 200 to perform communication, and one communication is performed by a pair of the monitoring device 100 and the end terminal 200. The device 3000 may be realized. The NIC of the PLC 400 may be realized by the monitoring device 100 to be a single device. Further, both the single monitoring device 100 and the communication device 3000 may be mixed in one network, or the security switch 2000 may be mixed.

Furthermore, in each of the above-described embodiments, the operation setting when the flow list is matched, the operation setting when the flow list is not matched, and the operation setting during the registration period are common to each monitoring device 100. It was supposed to be set to. However, instead of doing this, the contents set by each monitoring device 100 may be different. For example, the first monitoring device 100-1 is set to notify when the flow list does not match, while the first monitoring device 100-1 is set to notify the flow list even when the flow list does not match. You may set not to notify.

Further, in each of the above-described embodiments, the second network 900 is connected to the first network 800, but it is not always necessary to connect to the first network 800. Even when not connected to the first network 800, for example, detecting a malicious frame that occurs when a malicious user connects an unauthorized end terminal 200 to the corporate network. Can be done.

In the second embodiment described above, the operation period is reached after a predetermined time has elapsed from the registration period, and the operation is continued. In this case, the operation period may be changed to the registration period again, and if a predetermined time has elapsed after the transition, the operation period may be changed again. That is, the florist may be updated by re-registering.

For example, when a new end terminal is added after the transition of the operation period, the frame related to the added end terminal may be added to the florist by re-registering. In this case, the flow list may be left blank and the flow list may be recreated from scratch, or new frame information may be added to the existing flow list.

Further, in the description of the operation of each embodiment, the received multiple frame information is described in parallel with reference to the flowchart, but the frame information is not performed for the plurality of frames at once in this way. The operation may be performed each time one is received. That is, each of the above steps may be executed each time one frame is received.

Some or all of the above embodiments may also be described, but not limited to:

(Appendix 1) A storage means for storing a list of conditions of data to be processed by a predetermined process, and a storage means.
Analytical means for analyzing data and
It is a monitoring device equipped with
The analysis means analyzes the data transmitted and received by the terminal connected to the self-monitoring device without going through the relay device for route selection, and if the analysis result matches any of the conditions included in the list, the analysis means. The predetermined processing is performed on the received data corresponding to the analysis result, and if the compared analysis result does not match any of the conditions included in the list, the predetermined processing is performed on the received data corresponding to the data. A monitoring device characterized by performing processing other than processing.

(Appendix 2) The predetermined process is a process for transmitting the data to a destination designated by the sender of the data, and a process other than the predetermined process is a process in which the sender of the data sends the data. The monitoring device according to Appendix 1, wherein the processing does not include transmission to a designated destination.

(Supplementary Note 3) The description in Appendix 1 or 2, wherein the analysis means operates for all data transmitted and received by a terminal connected to the self-monitoring device without going through the relay device for selecting the route. Monitoring device.

(Supplementary note 4) The analysis means is characterized in that it analyzes data transmitted and received by a terminal in a predetermined period and adds the analysis result to the list as a condition of data to be subject to the predetermined processing. The monitoring device according to any one of 1 to 3.

(Appendix 5) Whether or not the analysis result matches any of the conditions included in the list as part of either or both of the predetermined processing and the processing other than the predetermined processing. The monitoring device according to any one of Supplementary note 1 to 4, wherein the result is notified to the outside.

(Appendix 6) A communication system including a plurality of monitoring devices according to any one of the appendices 1 to 5 and also including a plurality of the terminals.
A communication system characterized in that each of the plurality of terminals is connected to any one of the plurality of monitoring devices on a one-to-one basis.

(Appendix 7) A switch that includes a plurality of monitoring devices according to any one of the appendices 1 to 5 and also includes a plurality of ports for connecting the terminals.
Each of the ports corresponds to at least one of the plurality of monitoring devices.
Each of the terminals is a switch characterized in that it is also connected to a monitoring device corresponding to a port to which the own terminal is connected.

(Appendix 8) A communication device including the monitoring device according to any one of Supplementary note 1 to 5 and the terminal connected to the monitoring device.
The terminal included in the communication device is a communication device that communicates via the monitoring device included in the communication device.

(Appendix 9) A monitoring method performed by a monitoring device equipped with a storage means for storing a list of data conditions to be processed.
The data sent and received by the terminal connected to the self-monitoring device is analyzed without going through the relay device that selects the route, and if the analysis result matches any of the conditions included in the list, the analysis result corresponds to the analysis result. The predetermined processing is performed on the received data, and if the comparison analysis result does not match any of the conditions included in the list, processing other than the predetermined processing is performed on the received data corresponding to the data. A monitoring method characterized by doing.

(Appendix 10) A monitoring program that causes a computer equipped with a storage means for storing a list of data conditions to be processed to function as a monitoring device.
The computer
The data sent and received by the terminal connected to the self-monitoring device is analyzed without going through the relay device that selects the route, and if the analysis result matches any of the conditions included in the list, the analysis result corresponds to the analysis result. The predetermined processing is performed on the received data, and if the comparison analysis result does not match any of the conditions included in the list, processing other than the predetermined processing is performed on the received data corresponding to the data. A monitoring program characterized by functioning as a monitoring device.

The present invention is suitable for security measures in a relay device.

100-1 First monitoring device 100-2 Second monitoring device 100-N Nth monitoring device 100-M Third monitoring device 110 Frame analysis unit 120 Florist generation unit 130 Florist storage unit 200-1 First 1 end terminal 200-2 2nd end terminal 300 switch 400 PLC
500 PC
600 Firewall device 700 Internet 800 First network 900 Second network 1000 Setting terminal 2000 Security switch 3000 Communication device

Claims (7)

With multiple end terminals with a first communication port,
A PLC device having second and third communication ports and controlling the end terminal,
Multiple monitoring devices with 4th and 5th communication ports,
Is a communication system including
The first communication port and the second communication port are each connected to the individual fourth communication port.
The fifth communication port is electrically connected to each other and is connected to each other.
The third communication port is connected to a first network that does not include the end terminal .
The PLC device transmits a control frame to the end terminal and
The end terminal sends and receives frames to and from another end terminal or the PLC device.
The monitoring device is
It was transmitted from the first communication port to which the fourth communication port of the own device is connected, or transmitted from the second communication port to which the fourth communication port of the own device is connected. ,or,
A frame received at the first communication port to which the fourth communication port of the own device is connected, or received at the second communication port to which the fourth communication port of the own device is connected. Analysis means to analyze
It is characterized by comprising a standard for determining whether or not the frame is a regular frame, and a storage means for storing at least one of a process performed when the frame is met or a process performed when the frame is not matched. Communication system. The monitoring device is
If the analysis result matches any of the above criteria, the first process is performed.
The communication system according to claim 1, wherein when the analysis result does not match all of the criteria, a second process is performed. The first process is a process for transmitting the frame to a destination designated by the source of the frame.
The communication system according to claim 2, wherein the second process is a process of not transmitting the frame to a destination designated by the source of the frame. The analysis means is
The communication system according to any one of claims 1 to 3, wherein the analysis result is added to the reference in a predetermined period. The analysis means is
As a part of either or both of the first process and the second process, the feature is to notify the outside of the result of whether or not the analysis result matches any of the criteria. The communication system according to claim 2 or 3. The communication system according to any one of claims 1 to 5, wherein the destination of the frame is either the PLC device or the end terminal. The first communication port and the second communication port are all connected to the fourth communication port of the monitoring device, according to any one of claims 1 to 6. Communications system.

Images